Unless IT security gets real, non drill, respect, what's the point?

IT security won't get real respect until they actually know more than the people they annoy with their (literally) useless rules.

When you have some moron with a CISSP telling people who write network protocol stacks for a living what browsers they can use (this week), do you really expect to see a lot of "respect" flowing in that direction?

Modern InfoSec amounts to little more than snake-oil. AV vendors have admitted that their products can't keep us safe, while Mr. CISM insists on cranking up the settings to the point that an 24-core behemoth can barely get out of its own way.

Meanwhile, we hear about yet another fortune-500 compromise, with its own highly-paid head of IT security, on a daily basis.

You want respect? I get my job done. Try doing the same.

So you do not ever support disclosure. Okay, valid stance, though I do not happen to agree with you.

If no one forces their hand, companies have proven, repeatedly, that they will simply sit on known vulnerabilities until hell freezes over. In the mean time, countless millions of systems remain vulnerable. And if one random security researcher could find the exploit, so can government-funded hackers such as Dimona, the Russian mob, the NSA, Bureau 121, etc.

I would rather have critical exploits patched eventually, even if it means two days of increased visibility to the problem. YMMV.

Try "No, 90 days already gives you waaay too much time with vulnerable devices in the wild; so, time to play name-and-shame and see if that motivates you more than 'quality' or 'self-respect' did."

In fairness, I loathe FaceBook as well.

Key difference, though, Facebook doesn't nag me to join every time I check my email or calendar or pull something off my Drive. No doubt, they would if they offered any other services I had an interest in using without using FB itself; but since they don't, that doesn't really apply.

First, I consider myself a fan of the Googlesphere. I love Android, love Chrome, love GMail, enjoy the availability of their online Apps, and so on. (Hate hate hate Google+, though).

And saying that - Google needs to come to terms with the fact that they can't get away with the same bullshit update cycle for an OS installed on physical hardware, as they do with Chrome. For a desktop browser, weekly updates with support ending more-or-less after a year counts as an annoyance, but not a deal-killer. For an OS, just "no". My last phone lasted a decade - Support your devices (at least for critical vulnerability patches) for at least that long, or GTFO of the playground.

Obligations? The creator is free to limit publication as much as they like.

Uh-huh. Stuff that genie back in the bottle, Clyde! Tell me - Why do you think copyright eventually expires?

Hint: Have you ever heard of a guy named Bill Shakespeare? Pity, really, that he decided to burn his entire body of work as soon as it stopped making him money... I've heard (from commentary about commentary about commentary about commentary about commentary about commentary about commentary, of course, since each successive commenter also "limited publication as much as they like") that he wrote some quite good plays.

Copyright isn't only about sale, it's about creators' rights. You knuckleheads just don't seem to understand this.

True, but not how you meant it. Copyright exists to temporarily grant content creators a limited monopoly on the reproduction of their work, to reward them for creating it for us in the first place.

You pro-copyright knuckleheads just don't seem to understand that once you make use of the benefits of copyright, you need to follow through with the obligations of it. And if you won't make sure that somehow you carry out your half of the bargain in 95 years ("life+70" doesn't apply so well for companies, so "publication+95" will usually count as the earlier of the two), don't come whining when others fulfill your reciprocal obligations for you.

every single person to investigate or own the island was a free mason. Including Franklin Roosevelt! [...] I'm pretty sure every rumor about the free masons ruling the world was likely started by an actual Free Mason.

You could fairly argue that FDR did rule the world.

Jus' sayin'.

i'm wondering, can there be anything in there that justifies this cost?

Low-oxygen solder. To reduce bit-slew, of course.

This might result in you getting overlooked for promotions, but so be it.

1) Not if everyone figures out "hey, pla actually has a life! I want in on that!" and does the same thing; and,
2) You won't find me putting up with any company that has a "work yourself to death" culture for long enough to get promoted anyway.

If nothing else, I thank the Millennials for changing the BS work-before-life attitude that evolved in the '80s. Perhaps in another 20 years we'll actually have halfway decent working conditions in the US, with vacations and guaranteed sick time and everything. Of course, more likely they'll just sell out like the former-hippy 'Boomers who created the '80s did. I'll enjoy it while it lasts, though. :)

6/10. And you only scored that high because someone bit.

I will typically check my email (work or otherwise) as it comes in on my phone. Key word there, "check" - not "act on", not "respond to", not even "give a second thought".

I have always made it entirely clear to my employers that I treat my free time as my free time. Any time outside of 9-to-5, my employer should fully expect to find me either three hours from the nearest computer, or three sheets to the wind, or asleep, or any of a number of other conditions that would preclude me actually "working". Note that I don't act like a dick about it - If something needs to happen off-hours, I usually count as the first one to volunteer to stay late... With the understanding that I will come in similarly late the next day.

That said, I do appreciate having an "early warning system" for serious problems... If a server goes down over the weekend, I'll make a point of preparing myself for the inevitable barrage of shit that will fly around Monday morning - Extra cup of coffee, maybe even go in a few minutes early so I can do my normal settling-in routine before everyone expects me in six places at once.


As for blocking websites - Do any companies seriously still not block at least some websites?

Pluto: Never forget.

In my experience flights are often booked only a couple of weeks before the trip

"A couple of weeks" means a world of difference, as far as fares go, from "on a day's notice", the condition to which I replied.


the exact timing of a meeting is often unknown up until the last moment.

Ah, you don't mean business, you mean "business". Actually getting something productive done requires preparation. Schmoozing on the links, however? Suuure, fly first class with an hour's notice on the company dime, fuck those shareholders!

Is that before or after inflation?

Inflation-adjusted.


Because I'm pretty sure I couldn't get a flight from Chicago to LA on a day's notice in 1980 for the equivalent purchasing power of what it costs today.

Probably true - But you've compared one niche use case (and one drastically affected by improved technology, at that) against the market as a whole. Even accepting that business travel (and freight) makes up the vast majority of air traffic, most of it doesn't happen on a moment's notice.